{ "@id": "urn:uuid:48d616e3-b609-4e64-a3a0-0de795d32948", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T14:17:46.916788+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 The target (Netty 4.1.118.Final) is not affected by CVE-2014-3488. This vulnerability affected Netty 3.x before version 3.9.2 (2014), where SSLv2Hello messages could cause infinite loops due to inadequate BUFFER_OVERFLOW handling. The target uses Netty 4.x with completely different architecture that already includes proper BUFFER_OVERFLOW handling preventing the infinite loop. The fix was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 The target (Netty 4.1.118.Final) is not affected by CVE-2014-3488. This vulnerability affected Netty 3.x before version 3.9.2 (2014), where SSLv2Hello messages could cause infinite loops due to inadequate BUFFER_OVERFLOW handling. The target uses Netty 4.x with completely different architecture that already includes proper BUFFER_OVERFLOW handling preventing the infinite loop. The fix was intro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version 4.1.118.Final is much newer and includes the upstream fix. The vulnerable infinite loop pattern in OpenSSL error handling is not present. The fix, which properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by returning to the event loop instead of continuing to retry, was introduced by upstream commit cd3bf3df58c (Scott Mitchell, 2017-02-05) and predates all TuxCare commits in this branch. The fix is present in ReferenceCountedOpenSslEngine.java (lines 1002-1025), which OpenSslEngine.java extends. This is an upstream fix that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version 4.1.118.Final is much newer and includes the upstream fix. The vulnerable infinite loop pattern in OpenSSL error handling is not present. The fix, which properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by returning to the event loop instead of continuing to retry, was introduced by upstream commit cd3bf3df58c (Scott Mitchell, 2017-02-05) and predates all TuxCare commits in this branch. The fix is present in ReferenceCountedOpenSslEngine.java (lines 1002-1025), which OpenSslEngine.java extends. This is an upstream fix that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-11612 (unbounded memory allocation in Netty ZlibDecoders) is NOT present in this target. The fix commit 1543218d3e7afcb33a90b728b14370395a3deca0 shipped in the upstream Netty 4.1.118.Final release that TuxCare onboarded. The vulnerable code pattern (decompression with no size limit capability) has been replaced by code that supports configurable buffer limits via the maxAllocation parameter. The ZlibDecoder base class and all subclasses (JZlibDecoder, JdkZlibDecoder) contain the prepareDecompressBuffer() defense mechanism that enforces the limit and throws DecompressionException when exceeded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11612" }, "impact_statement": "CVE-2020-11612 (unbounded memory allocation in Netty ZlibDecoders) is NOT present in this target. The fix commit 1543218d3e7afcb33a90b728b14370395a3deca0 shipped in the upstream Netty 4.1.118.Final release that TuxCare onboarded. The vulnerable code pattern (decompression with no size limit capability) has been replaced by code that supports configurable buffer limits via the maxAllocation parameter. The ZlibDecoder base class and all subclasses (JZlibDecoder, JdkZlibDecoder) contain the prepareDecompressBuffer() defense mechanism that enforces the limit and throws DecompressionException when exceeded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-7238 concerns HTTP Request Smuggling in Netty due to mishandling requests with (1) multiple Content-Length headers or (2) both Content-Length and Transfer-Encoding: chunked headers. The target repository (Netty 4.1.118.Final-tuxcare.1) is NOT AFFECTED because the fix was already present in the upstream Netty 4.1.118.Final release that TuxCare onboarded. The fix was authored by Norman Maurer (norman_maurer@apple.com) in commit 8494b046ec and includes validation logic that rejects both attack patterns by default. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-7238" }, "impact_statement": "CVE-2020-7238 concerns HTTP Request Smuggling in Netty due to mishandling requests with (1) multiple Content-Length headers or (2) both Content-Length and Transfer-Encoding: chunked headers. The target repository (Netty 4.1.118.Final-tuxcare.1) is NOT AFFECTED because the fix was already present in the upstream Netty 4.1.118.Final release that TuxCare onboarded. The fix was authored by Norman Maurer (norman_maurer@apple.com) in commit 8494b046ec and includes validation logic that rejects both attack patterns by default. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 The target Netty 4.1.118.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability (unbounded ClientHello allocation up to 16MB leading to DoS) does not exist because the upstream Netty project already included the fix in version 4.1.118.Final. The fix was authored by Norman Maurer (norman_maurer@apple.com) in commit 535da17e45 and shipped with the upstream release that TuxCare onboarded. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 The target Netty 4.1.118.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability (unbounded ClientHello allocation up to 16MB leading to DoS) does not exist because the upstream Netty project already included the fix in version 4.1.118.Final. The fix was authored by Norman Maurer (norman_maurer@apple.com) in commit 535da17e45 and shipped with the upstream release that TuxCare onboarded. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.118.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T14:17:46.916788+00:00", "status_notes": "Vulnerability CVE-2025-24970 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler. The upstream fix was released in 4.1.118.Final, and version 4.1.118.Final is a later release of the same line. Advisories: GitHub GHSA-4g8c-wm8x-jfhw (fixed in 4.1.118.Final), NVD (fixed in 4.1.118), CVE record (last affected 4.1.117.Final), Snyk (fixed in 4.1.118.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24970" }, "impact_statement": "The upstream fix was released in 4.1.118.Final, and version 4.1.118.Final is a later release of the same line. Advisories: GitHub GHSA-4g8c-wm8x-jfhw (fixed in 4.1.118.Final), NVD (fixed in 4.1.118), CVE record (last affected 4.1.117.Final), Snyk (fixed in 4.1.118.Final)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-44249" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-45416" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2026-75595 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.118.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:10:13.564095+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-handler." } ] }